REMARKS 



In the Official Action mailed on 19 August 2009, the Examiner reviewed 
claims 1-30. Examiner rejected claim 1 under 35 U.S.C. § 101. Examiner 
provisionally rejected claims 1-17 on the ground of non-statutory obviousness- 
type double patenting as being unpatentable over claims 1-22 of co-pending 
Application No. 10/701,154 and co-pending Application No. 10/701,356. 
Examiner rejected claims 1-9, and 1 1-23, and 25-30 under 35 U.S.C. § 102(e) 
based on Tarns et al. (U.S. Pub. No. 2003/0069952, hereinafter "Tarns"). 
Examiner rejected claims 10 and 24 under 35 U.S.C. § 103(a) based on Tarns, in 
view of Maufer et al. (U.S. Patent No. 7,120,930, hereinafter "Maufer"). 

Double Patenting Rejection 

Examiner provisionally rejected claims 1-17 on the ground of non- 
statutory obviousness-type double patenting as being unpatentable over claims 1- 
22 of co-pending Application No. 10/701,154 and co-pending Application No. 
10/701,356. In compliance with 37 CFR 1 .321, Applicant has filed a terminal 
disclaimer (see attached). 

Rejections under 35 U.S.C. § 101 

Examiner rejected claim 1 under 35 U.S.C. § 101, stating that claim 1 
appears to be directed to a data structure. Applicant has amended claim 1 so that 
the claimed invention is directed to a computer system. Applicant has similarly 
amended claim 18 and corresponding dependent claims. Support for these 
amendments is found in instant application, Figure 3. No new matter has been 
added. Applicant submits that the amended claims overcome the 101 rejection. 



8 

AEP: Amendment E RIV-0550 (non-final OAR).doc 



Rejections under 35 U.S.C. $ 102 

Examiner rejected claims 1-9, and 1 1-23, and 25-30 under 
35 U.S.C. § 102(e) based on Tarns. Applicant respectfully disagrees with this 
rejection. Tarns does not disclose a connection table that maps each node of a 
network to a record that stores information indicating whether the node is 
operating as a client as a server. 

Specifically, Tarns discloses tables that "monitor conversations which 
occur in the network, and keep count of the total number of bytes and packets 
seen for each conversation for each monitored protocol" (Tarns, par. [0021]). 
Furthermore, "each record is used to represent a conversation between two hosts 
and the records are time aligned depending on the resolution. . ." (Tarns, par. 
[0201]). Nowhere does Tarns disclose that the records include information 
indicating whether the node is operating as a client or as a server. 

In contrast, embodiments of the present invention store information about 
whether the node is operating as a client or operating as a server. Whether a node 
is operating as a client or a server can be determined, for example, by determining 
whether the node sent a "sync" packet or a "synch_ack" packet. Typically, if the 
protocol is TCP the source of the "sync" packet is the client and the source of the 
"synch ack" packet is the server. If the protocol is not TCP, whether a node is 
operating as a client or a server can be determined by both the port number and a 
previous source of a "synch ack" packet. Storing client/server statistics can be 
useful to detect anomalies such as worm intrusions and other types of intrusions. 
See instant application, P7:L24-P8:L20. 

Hence, Tarns does not disclose the feature of determining whether a node 
is operating as a client or a server, nor does Tarns disclose receiving this 
information from an external source and storing it. 

Accordingly, Applicant has amended independent claims 1 and 18 to 

clarify that embodiments of the present invention involve a connection table that 

maps each node of a network to a record that stores information about traffic to or 
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from the node and between that node and other nodes in the network and stores 
information indicating whether the node is operating as a client or a server. 
Support for these amendments is found in instant application, P7:L24-P8:L20. 
Applicant has also amended claims 8-12, 16, 22-26 and 29 to improve clarity 
and/or provide proper antecedent basis. No new matter has been added. 

Hence, Applicant respectfully submits that independent claims 1 and 18, 
as currently amended, are in condition for allowance. Applicant also submits that 
claims 2-17 and 26, which depend upon claim 1, and claims 19-25 and 27-30, 
which depend upon claim 18, are for the same reasons in condition for allowance 
and for reasons of the unique combinations recited in such claims. 
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CONCLUSION 



It is submitted that the application is presently in form for allowance. Such 
action is respectfully requested. 

Respectfully submitted, 



By /ShunYao/ 

Shun Yao 

Registration No. 59,242 
Date: 19 November 2009 



Shun Yao 

Park, Vaughan & Fleming LLP 
2820 Fifth Street 
Davis, CA 95618-7759 
Tel: (530) 759-1667 
Fax: (530) 759-1665 
Email: shun fa parklcgal.com 
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